package com.huatai.user.config;

import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

/**
 * @program: ht-system
 * @description: 安全拦截
 * @author: songxiude
 * @create: 2023-02-15 14:26
 **/
@Configuration
@EnableGlobalMethodSecurity(securedEnabled = true,prePostEnabled = true)
//@Order(1)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		//正式环境
		http.csrf().disable()
			.authorizeRequests()
			.antMatchers("/**").access("#oauth2.hasScope('all')")
			.anyRequest().permitAll();//除了/r/**，其它的请求可以访问

		//测试放行环境
//		http.csrf().disable()
//			.authorizeRequests()
//			.antMatchers("/r/**").authenticated()//所有/r/**的请求必须认证通过
//			.anyRequest().permitAll();//除了/r/**，其它的请求可以访问

	}
}
